CVE Vulnerability Catalog

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

The Zero Spam for WordPress plugin (up to and including 5.7.10) is vulnerable to Stored Cross-Site Scripting (XSS) via Nested POST Array Keys through its Contact Form 7 integration due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field.

The Restaurant Menu and Food Ordering plugin for WordPress (up to and including 2.4.14) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'phone_number' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page.

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak occurs because the system does not inspect composite roles when checking whether a delegated administrator may assign a specific role. An administrator with limited rights can assign a role that secretly includes full administrative control.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress (up to and including 4.0.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.

The Themify Builder plugin for WordPress (up to and including 7.8.1) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'css[fonts]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.

The Repeater Fields for Elementor Forms plugin for WordPress (up to and including 2.2.7) is vulnerable to Stored Cross-Site Scripting (XSS) via Repeater Field Value due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Optima Express IDX plugin for WordPress (versions up to and including 8.7.5) is vulnerable to privilege escalation. The provisionBlogCredentials() function is reachable via the wp_ajax_nopriv_ihf_clear_cache AJAX action without capability checks, nonce verification, or ownership validation, and unconditionally sets the 'author' role for the account with login 'optima-express'. An unauthenticated attacker can register that username (if open registration is enabled) and gain author privileges.

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to and including 3.1.6. The raw $_POST['data'] array is copied into $custom_fields before validate() and sanitize() run, leaving it unsanitized when persisted.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Avatar Field in all versions up to and including 4.0.2 due to insufficient input sanitization and output escaping. It is exploitable via a nonce-free GET request to /wp-admin/profile.php without requiring a profile-form submission.

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1) is vulnerable to stored cross-site scripting via the 'cart_items[][product_name]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, allowing an unauthenticated attacker to persist the payload and make it renderable to any logged-in user.

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress (versions up to and including 3.0.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function. An authenticated attacker with author-level access or higher can delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and authors trivially satisfy the edit_post check on their own galleries.

A session fixation vulnerability in HTTP management authentication in Apache Qpid Broker-J (through 10.1.0) allows remote attackers to gain unauthorized access to an authenticated management session by reusing a session identifier retained across successful authentication.

Improper handling of property-encoding exceptions during AMQP 1.0-to-AMQP 0-10 message conversion in Apache Qpid Broker-J (through 10.1.0) allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers. This occurs via message properties that the target encoder does not handle correctly.